map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2)
{
if (a0 == 0xc || a0 == 0xb) {
char buf[128];
sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1, (uint8_t)a2);
return open(buf, O_RDWR, 0);
} else {
unsigned long nb = a1;
char buf[1024];
char* hash;
strncpy(buf, (char*)a0, sizeof(buf) - 1);
buf[sizeof(buf) - 1] = 0;
while ((hash = strchr(buf, '#'))) {
*hash = '0' + (char)(nb % 10);
nb /= 10;
}
return open(buf, a2 & ~O_CREAT, 0);
}
}
uint64_t r[1] = {0x0};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// prctl$PR_SCHED_CORE arguments: [
// option: const = 0x3e (8 bytes)
// cmd: intptr = 0x1 (8 bytes)
// pid: pid (resource)
// type: pid_type = 0x0 (8 bytes)
// uaddr: nil
// ]
syscall(__NR_prctl, /*option=*/0x3eul, /*cmd=*/1ul, /*pid=*/0, /*type=*/0ul, /*uaddr=*/0ul);
// getpid arguments: [
// ]
// returns pid
res = syscall(__NR_getpid);
if (res != -1)
r[0] = res;
// process_vm_readv arguments: [
// pid: pid (resource)
// loc_vec: ptr[in, array[iovec[out, array[int8]]]] {
// array[iovec[out, array[int8]]] {
// iovec[out, array[int8]] {
// addr: ptr[out, buffer] {
// buffer: (DirOut)
// }
// len: len = 0xfffffff7 (8 bytes)
// }
// iovec[out, array[int8]] {
// addr: ptr[out, buffer] {
// buffer: (DirOut)
// }
// len: len = 0x98 (8 bytes)
// }
// }
// }
// loc_vlen: len = 0x2 (8 bytes)
// rem_vec: ptr[in, array[iovec[out, array[int8]]]] {
// array[iovec[out, array[int8]]] {
// iovec[out, array[int8]] {
// addr: ptr[out, buffer] {
// buffer: (DirOut)
// }
// len: len = 0x7ffff000 (8 bytes)
// }
// }
// }
// rem_vlen: len = 0x286 (8 bytes)
// flags: const = 0x0 (8 bytes)
// ]
*(uint64_t*)0x200000008400 = 0x200000000300;
*(uint64_t*)0x200000008408 = 0xfffffff7;
*(uint64_t*)0x200000008410 = 0x200000006180;
*(uint64_t*)0x200000008418 = 0x98;
*(uint64_t*)0x200000008640 = 0x200000008480;
*(uint64_t*)0x200000008648 = 0x7ffff000;
syscall(__NR_process_vm_readv, /*pid=*/r[0], /*loc_vec=*/0x200000008400ul, /*loc_vlen=*/2ul, /*rem_vec=*/0x200000008640ul, /*rem_vlen=*/0x286ul, /*flags=*/0ul);
// prctl$PR_SCHED_CORE arguments: [
// option: const = 0x3e (8 bytes)
// cmd: intptr = 0x2 (8 bytes)
// pid: pid (resource)
// type: pid_type = 0x1 (8 bytes)
// uaddr: nil
// ]
syscall(__NR_prctl, /*option=*/0x3eul, /*cmd=*/2ul, /*pid=*/r[0], /*type=PIDTYPE_TGID*/1ul, /*uaddr=*/0ul);
// ioctl$PPPIOCSCOMPRESS arguments: [
// fd: fd_ppp (resource)
// cmd: const = 0x4010744d (4 bytes)
// ]
syscall(__NR_ioctl, /*fd=*/(intptr_t)-1, /*cmd=*/0x4010744d, 0);
// syz_open_dev$mouse arguments: [
// dev: nil
// id: intptr = 0x8000000000000001 (8 bytes)
// flags: open_flags = 0x2000 (8 bytes)
// ]
// returns fd
syz_open_dev(/*dev=*/0, /*id=*/0x8000000000000001, /*flags=FASYNC*/0x2000);
return 0;
}
]